SOC Operations Leader (AVP) – Remote Fridays & Equity

iCapital; Lisboa; Híbrido; EUR 90 000 - 130 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Equity for all full-time employees

Annual performance bonus

Healthcare with 100% employer-paid HE/

Paid time off

Resumo da oferta

iCapital is seeking a Security Operations Manager - Assistant Vice President to lead the Global Information Security SOC in Lisbon, Portugal. You will manage day-to-day SOC operations, mentor analysts, and drive runbooks, incident handling, and tool configurations.

The role involves coordinating with Threat Detection, Cloud Security, and Incident Response teams to strengthen cyber resiliency, with four days in-office and one day remote to cover global time zones.

Qualificações

• 5-8 years of experience in security operations with 1-3 years in a SOC or security operations leadership.
• Proven people-management experience with scheduling, hiring, and mentoring.
• Hands-on setup and management of SIEM/SOAR platforms (Splunk preferred).
• Experience with incident-response lifecycle and frameworks (NIST/MITRE ATT&CK).
• Fluency in English and ability to liaise across global teams.

Responsabilidades

• Manage day-to-day operations of the Security Operations Center across global time zones.
• Lead, mentor, and develop a team of SOC analysts, including scheduling and onboarding.
• Maintain runbooks, playbooks, and incident-handling procedures.
• Operate and tune SIEM and SOAR platforms; maintain alerts/dashboard surfaces security events.
• Triage incidents and coordinate response with cross-team partners.

Conhecimentos

SOC operations

Team leadership

Splunk

SOAR

NIST ATT&CK

AWS

English

Incident response

Security tools

Ferramentas

Splunk

SOAR

AWS

Descrição da oferta de emprego

iCapital is seeking a Security Operations Manager - Assistant Vice President to lead the Global Information Security SOC in Lisbon, Portugal. You will manage day-to-day SOC operations, mentor analysts, and drive runbooks, incident handling, and tool configurations.

The role involves coordinating with Threat Detection, Cloud Security, and Incident Response teams to strengthen cyber resiliency, with four days in-office and one day remote to cover global time zones.